Electronic payment systems rely on data encryption in order to secure the data tokens used by consumers and merchants to authorize payment. Credit card numbers are particularly sensitive data because a complete card number, and its attendant data, can be submitted by anyone for purchase. Similarly, any other kind of payment authorization token suffers the same vulnerability. At the same time, merchants operating computerized sales transaction systems have a need to store this sensitive data for periods of time. In some cases, the customer agrees that the merchant can store the credit card in order that consumer enjoy the convenience of not re-entering the numbers into their browser interface operating on their computer. Industry best practices dictate that storage of credit card numbers and any other type of payment authorization token be secured by means of encrypting the data. However, encryption simply shifts the data security vulnerability from the data itself (which is now encrypted) to the security of the keys. One solution is that the data encryption keys (DEK) be changed periodically. During that process, all of the encrypted data needs to be re-keyed. This means that the system's day to day business operation is suspended while new encryption keys are generated and each encrypted data item in the payment token database is decrypted with the old key and re-encrypted with the new one. This process, commonly referred to as key rotation and re-keying can cause disruption of business operations.
Therefore, there is a need for a key rotation mechanism that permits the electronic transaction to continue to operate during the key rotation and re-keying process. These and other objects, features and characteristics of the present invention will become more apparent to those skilled in the art from a study of the following detailed description in conjunction with the appended claims and drawings, all of which form a part of this specification. It should be understood that the description and specific examples are intended for purposes of illustration only and not intended to limit the scope of the present disclosure.